Package org.opends.server.authorization.dseecompat

Class AciHandler

java.lang.Object

org.opends.server.api.AccessControlHandler<DseeCompatAccessControlHandlerCfg>

org.opends.server.authorization.dseecompat.AciHandler

public final class AciHandler
extends AccessControlHandler<DseeCompatAccessControlHandlerCfg>

The AciHandler class performs the main processing for the dseecompat package.

Constructor Summary

Constructors

Constructor	Description
AciHandler()	Creates a new DSEE-compatible access control handler.

Method Summary

Modifier and Type	Method	Description
void	filterEntry(Operation operation, SearchResultEntry unfilteredEntry, SearchResultEntry filteredEntry)	Filter the contents of the provided entry such that it no longer contains any attributes or values that the client is not permitted to access.
void	finalizeAccessControlHandler()	Performs any necessary finalization for the access control handler implementation.
void	initializeAccessControlHandler(DseeCompatAccessControlHandlerCfg configuration)	Initializes the access control handler implementation based on the information in the provided configuration entry.
boolean	isAllowed(DN entryDN, Operation op, Control control)	Indicates whether the provided control is allowed based on the access control configuration and the specified operation.
boolean	isAllowed(BindOperation bindOperation)	Indicates whether the provided bind operation is allowed based on the access control configuration.
boolean	isAllowed(ExtendedOperation operation)	Indicates whether the provided extended operation is allowed based on the access control configuration.
boolean	isAllowed(ModifyDNOperation operation)	Checks access on a modifyDN operation.
boolean	isAllowed(SearchOperation searchOperation)	Indicates whether the provided search operation is allowed based on the access control configuration.
boolean	isAllowed(Operation operation, Entry entry, SearchFilter filter)	Indicates whether the provided operation search filter is allowed based on the access control configuration.
boolean	isAllowed(LocalBackendAddOperation operation)	Indicates whether the provided add operation is allowed based on the access control configuration.
boolean	isAllowed(LocalBackendCompareOperation operation)	Check access on compare operations.
boolean	isAllowed(LocalBackendDeleteOperation operation)	Check access on delete operations.
boolean	isAllowed(LocalBackendModifyOperation operation)	Indicates whether the provided modify operation is allowed based on the access control configuration.
boolean	mayProxy(Entry proxyUser, Entry proxiedUser, Operation op)	Indicates if the specified proxy user entry can proxy, or act on the behalf of the specified proxied user entry.
boolean	maySend(DN dn, Operation operation, SearchResultReference reference)	Indicates whether the provided search result reference may be sent to the client based on the access control configuration.
boolean	maySend(Operation operation, SearchResultEntry entry)	Indicates whether the provided search result entry may be sent to the client.

Methods inherited from class org.opends.server.api.AccessControlHandler

canDiscloseInformation, isConfigurationAcceptable

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AciHandler

public AciHandler()

Creates a new DSEE-compatible access control handler.

Method Detail

filterEntry

public void filterEntry(Operation operation,
                        SearchResultEntry unfilteredEntry,
                        SearchResultEntry filteredEntry)

Description copied from class: AccessControlHandler

Filter the contents of the provided entry such that it no longer contains any attributes or values that the client is not permitted to access.

Specified by:

filterEntry in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The operation currently being processed (this will usually be a search, but may be other types of operation when pre/post read controls are used).

unfilteredEntry - The result entry before any attribute filtering.

filteredEntry - The partially filtered result entry being returned to the client.

finalizeAccessControlHandler

public void finalizeAccessControlHandler()

Description copied from class: AccessControlHandler

Performs any necessary finalization for the access control handler implementation. This will be called just after the handler has been deregistered with the server but before it has been unloaded.

Specified by:

finalizeAccessControlHandler in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

initializeAccessControlHandler

public void initializeAccessControlHandler(DseeCompatAccessControlHandlerCfg configuration)
                                    throws ConfigException,
                                           InitializationException

Description copied from class: AccessControlHandler

Initializes the access control handler implementation based on the information in the provided configuration entry.

Specified by:

initializeAccessControlHandler in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

configuration - The configuration object that contains the information to use to initialize this access control handler.

Throws:

ConfigException - If an unrecoverable problem arises in the process of performing the initialization.

InitializationException - If a problem occurs during initialization that is not related to the server configuration.

isAllowed

public boolean isAllowed(DN entryDN,
                         Operation op,
                         Control control)
                  throws DirectoryException

Description copied from class: AccessControlHandler

Indicates whether the provided control is allowed based on the access control configuration and the specified operation. This method should not alter the provided operation in any way.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

entryDN - A DN that can be used in the access determination.

op - The operation to use in the determination.

control - The control for which to make the determination.

Returns:

true if the control should be allowed by the access control configuration, or false if not.

Throws:

DirectoryException - If an error occurred while performing the access control check. For example, if an attribute could not be decoded. Care must be taken not to expose any potentially sensitive information in the exception.

isAllowed

public boolean isAllowed(ExtendedOperation operation)

Description copied from class: AccessControlHandler

Indicates whether the provided extended operation is allowed based on the access control configuration. This method should not alter the provided extended operation in any way.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The operation for which to make the determination.

Returns:

true if the operation should be allowed by the access control configuration, or false if not.

isAllowed

public boolean isAllowed(LocalBackendAddOperation operation)
                  throws DirectoryException

Description copied from class: AccessControlHandler

Indicates whether the provided add operation is allowed based on the access control configuration. This method should not alter the provided add operation in any way.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The operation for which to make the determination.

Returns:

true if the operation should be allowed by the access control configuration, or false if not.

Throws:

DirectoryException - If an error occurred while performing the access control check. For example, if an attribute could not be decoded. Care must be taken not to expose any potentially sensitive information in the exception.

isAllowed

public boolean isAllowed(BindOperation bindOperation)

Description copied from class: AccessControlHandler

Indicates whether the provided bind operation is allowed based on the access control configuration. This method should not alter the provided bind operation in any way.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

bindOperation - The operation for which to make the determination.

Returns:

true if the operation should be allowed by the access control configuration, or false if not.

isAllowed

public boolean isAllowed(LocalBackendCompareOperation operation)

Check access on compare operations. Note that the attribute type is unavailable at this time, so this method partially parses the raw attribute string to get the base attribute type. Options are ignored.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The compare operation to check access on.

Returns:

True if access is allowed.

isAllowed

public boolean isAllowed(LocalBackendDeleteOperation operation)

Check access on delete operations.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The delete operation to check access on.

Returns:

True if access is allowed.

isAllowed

public boolean isAllowed(ModifyDNOperation operation)

Checks access on a modifyDN operation.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The modifyDN operation to check access on.

Returns:

True if access is allowed.

isAllowed

public boolean isAllowed(LocalBackendModifyOperation operation)
                  throws DirectoryException

Description copied from class: AccessControlHandler

Indicates whether the provided modify operation is allowed based on the access control configuration. This method should not alter the provided modify operation in any way.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The operation for which to make the determination.

Returns:

true if the operation should be allowed by the access control configuration, or false if not.

Throws:

DirectoryException - If an error occurred while performing the access control check. For example, if an attribute could not be decoded. Care must be taken not to expose any potentially sensitive information in the exception.

isAllowed

public boolean isAllowed(SearchOperation searchOperation)

Description copied from class: AccessControlHandler

Indicates whether the provided search operation is allowed based on the access control configuration. This method may only alter the provided search operation in order to add an opaque block of data to it that will be made available for use in determining whether matching search result entries or search result references may be allowed.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

searchOperation - The operation for which to make the determination.

Returns:

true if the operation should be allowed by the access control configuration, or false if not.

isAllowed

public boolean isAllowed(Operation operation,
                         Entry entry,
                         SearchFilter filter)
                  throws DirectoryException

Description copied from class: AccessControlHandler

Indicates whether the provided operation search filter is allowed based on the access control configuration. This method should not alter the provided operation in any way.

Specified by:

isAllowed in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The operation for which to make the determination.

entry - The entry for which to make the determination.

filter - The filter to check access on.

Returns:

true if the operation should be allowed by the access control configuration, or false if not.

Throws:

DirectoryException - If an error occurred while performing the access control check. For example, if an attribute could not be decoded. Care must be taken not to expose any potentially sensitive information in the exception.

mayProxy

public boolean mayProxy(Entry proxyUser,
                        Entry proxiedUser,
                        Operation op)

Description copied from class: AccessControlHandler

Indicates if the specified proxy user entry can proxy, or act on the behalf of the specified proxied user entry. The operation parameter is used in the evaluation.

Specified by:

mayProxy in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

proxyUser - The entry to use as the proxy user.

proxiedUser - The entry to be proxied by the proxy user.

op - The operation to use in the evaluation.

Returns:

true if the access control configuration allows the proxy user to proxy the proxied user, or false if not.

maySend

public boolean maySend(DN dn,
                       Operation operation,
                       SearchResultReference reference)

Description copied from class: AccessControlHandler

Indicates whether the provided search result reference may be sent to the client based on the access control configuration.

Specified by:

maySend in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

dn - A DN that can be used in the access determination.

operation - The operation with which the provided reference is associated.

reference - The search result reference for which to make the determination.

Returns:

true if the access control configuration allows the reference to be returned to the client, or false if not.

maySend

public boolean maySend(Operation operation,
                       SearchResultEntry entry)

Description copied from class: AccessControlHandler

Indicates whether the provided search result entry may be sent to the client. Implementations must not under any circumstances modify the search entry in any way.

Specified by:

maySend in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>

Parameters:

operation - The operation currently being processed (this will usually be a search, but may be other types of operation when pre/post read controls are used).

entry - The result entry before any attribute filtering.

Returns:

true if the access control configuration allows the entry to be returned to the client, or false if not.